coinbasolnet[.]com

The domain coinbasolnet.com is identified as a high-risk brand impersonation threat targeting Facebook. Analysis indicates that the domain is designed to mimic Facebook's login page, with the page title 'Bei Facebook anmelden' suggesting a German-speaking audience. No evidence of a crypto drainer kit was found during the initial assessment.

Technical indicators reveal that coinbasolnet.com has been flagged by 11 out of 95 security vendors on VirusTotal. The domain is registered through Dominet (HK) Limited, a registrar known for being used by malicious actors. The domain resolves to the IP address 157.240.0.35, which is located in Germany and is part of the AS32934 network, commonly associated with Facebook, Inc. The domain was created on June 12, 2025, and is currently listed on three security blocklists. Despite the IP's association with Facebook, the lack of an SSL certificate and the presence on blocklists indicate suspicious activity.

Currently, the domain is offline, having been taken down as part of response actions to mitigate the threat. However, the remaining risk is still considered high due to the domain's potential to be reactivated or used in similar future attacks. Users are advised to avoid visiting or interacting with this domain and to report any related suspicious activity to their security teams. Security providers are recommended to continue monitoring the domain and its associated infrastructure for any signs of re-emergence or related malicious activities.